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8KB bit-table 



loiiioooiooiooiooooiooooioooooooooi 

00000100100100010001000100001000101 

00010010000010 000010001000010001000 

loooooooiooooiooiooooioooiobiooiool 
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CRC16: FA 
Index: 5 


CRC16: FA 
Index: 45 


,CRC16: 77 
Index: 97 



Verifier Element 



r 



Verification tests: <crc, traceinfo, cprl> 

CRC1 : <crc used for verifiication> 

CRC2: <a secondary ac used for 
verification as necessary> 

crc1 Jen: <number of instructions 
represented by CRC1> 

crc2Jen: <number of instructions 
represented by CRC2> 

crc1_model: <model represented by crc1> 

crc2_model: <model represented by ac2> 

TRACEINFO: <trace information that can 
be used as verif(ers> 

CPRL: <small cpri string used to verify 
information for this knovwi vinjs> 

Virus Name: <name of the virus this verifier 
represents> 



Any two byte CRC contains a value from 0 to 65535. An eight kilobyte table contains 65536 bits. 
Therefore each bit in the 8k table can therefore represent a value from 0 (the first bit) to 65535 (the last bit). 
In other words, every value from 0 to 65531 can be represented by a single bit in and 8k table. 

The following is an example of an algorithm that can be used to mask a CRC value to a single bit in the 
table: 

C = CRC; B = Byte in table that contains the bit. b = the bit number that represents C. M = mask byte. 

Note: Bit values 0 to 7 are represented by location, not by value. 
Exan5)le: 

1000000 = bit 0 set. 

0000100 = bit 5 is set 

Algorithm 

b = C^8 
B = C/8 

Set high bit only in M (1000000) 

Shift byte right by count b. (if b = 0 then no shift occurs) 

Bitwise AND M against B. 

If NOT zero then match. 

Pseudo Code 

boolean 

MASK (WORD C, //CRC 

BYTE *TABLE) // pointer to table 

{ 



WORD B; 


// which byte in table 


BYTE b; 


// bit count 


BYTE M; 


//bit mask 


BYTE *N; 


// pointer to byte in table 


M = 0X8000; 


// initialize to binary 10000000 


B = C/8; 


// number of byte in table 


b = C^8; 


// remainder of C / 8 


N = TABLE + B; 


// point to byte in table 


M = M»b; 


//shift righto to 7 bits 


if(MAND*N) 


// AND Mask and Byte N in table 


return true; 


// bit is set 


return false; 


//bit is not set. 



} 
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